CVE-2026-70184: Windows Backup Engine Elevation of Privilege Vulnerability
Improper resolution of path equivalence in Windows Backup Engine allows an authorized attacker to elevate privileges locally.
Other sources
Windows Backup Engine Elevation of Privilege Vulnerability
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.26300.9711Patch KB5127648 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.19044.7807Patch KB5126657 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.22631.7652Patch KB5126653 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.28000.3231Patch KB5127646 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.26100.9711Patch KB5127648 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.26200.9711Patch KB5127648
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker must already be authorized to access the affected system and must be able to run attacks locally. The provided CVSS vector indicates low privileges are required and no user interaction is needed.
What systems are identified as affected?
The affected software listed is Microsoft Windows 10 and Microsoft Windows 11. No specific editions, builds, or update levels are provided.
What is the potential impact after exploitation?
Successful exploitation can allow local elevation of privilege. The supplied severity vector indicates high impact to confidentiality, integrity, and availability.